sami7777/dashcaddy
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

P7 spec rev5: DC-150 ticket X25519-only (remove ECDSA fallback contradiction)

Browse Source
This commit is contained in:
Hermes committed 2026-10-03 21:54:40 -07:00
1 parent a4f961d609
commit a39602afe5
1 file changed
+4 -2
Download Patch File Download Diff File Expand all files Collapse all files
BACKLOG.md
+4 -2
View File
@@ -538,8 +538,10 @@ Tickets DC-046 through DC-049 implement pluggable auth + email magic link. Sami
### DC-150: WireGuard invites (QR) + client config ### DC-150: WireGuard invites (QR) + client config
- **status:** todo - **status:** todo
- **details:** one-time token (7d TTL, single-use) → redemption page. Client - **details:** one-time token (7d TTL, single-use) → redemption page. Client
keypair generated IN THE BROWSER (WebCrypto X25519, ECDSA-P256 fallback); keypair generated IN THE BROWSER via WebCrypto X25519 ONLY — NO fallback
server receives the public key only, registers the peer /32, returns config algorithm; browsers lacking X25519 get an explicit unsupported-browser
failure. Server receives the public key only, registers the peer /32,
returns config
(Address, DNS=10.53.0.1, hub PublicKey, AllowedIPs=10.53.0.0/16 — a CIDR, (Address, DNS=10.53.0.1, hub PublicKey, AllowedIPs=10.53.0.0/16 — a CIDR,
never a DNS zone). Config + QR rendered client-side; private key never never a DNS zone). Config + QR rendered client-side; private key never
transits or rests on the server. Tests: token lifecycle, single-use transits or rests on the server. Tests: token lifecycle, single-use